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We claim: 

1. In a computer system, a method of expressing a code invocation contract in 
computer program code, wherein the computer program code is stored on a computer- 

5 readable medium, and wherein the computer program code is operable to cause a 
computer to perform according to instructions in the computer program code, the 
method comprising: 

adding one or more keywords to a function interface for a function in the 
computer program code, wherein the one or more keywords define the code invocation 
10 contract for the function, the contract having one or more contract requirements; 

wherein the one or more contract requirements are independent of function call 
context. 

2. The method of claim 1 wherein the one or more contract requirements 
1 5 include a postcondition. 

3. The method of claim 1 wherein the one or more contract requirements 
include a precondition. 

20 4. The method of claim 1 wherein the one or more contract requirements 

include one or more conditions to be fulfilled by one or more calling functions. 

5. The method of claim 1 wherein the one or more contract requirements 
include one or more conditions to be fulfilled by one or more called functions. 

25 

6. A computer-readable, program-carrying medium having carried thereon 
computer program code having keywords added to the computer program code 
according to the method of claim 1. 
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7. In a computer system, a method of annotating computer program code stored 
on a computer-readable medixun, wherein the computer program code is operable to 
cause a computer to perform according to instructions in the computer program code, 
5 the method comprising: 

inserting one or more code annotations only at one or more aimotation targets; 

wherein each of the one or more aimotation targets is of an annotation target 
category selected from a group consisting of: global variable, formal parameter of a 
function, return value of a function, user-defined data type. 



8. The method of claim 7 wherein the inserting one or more code annotations 
only at one or more annotation targets comprises inserting default annotations. 

9. The method of claim 7 wherein the one or more code annotations include a 



10 



15 property. 



10. The method of claim 9 wherein the property includes an implicit 
dereference qualifier. 



20 



1 1 . The method of claim 9 wherein the property is read only. 



12. The method of claim 9 wherein the property is a retum value property. 



13. The method of claim 9 wherein the property indicates a characteristic of a 



25 



buffer. 



14. The method of claim 13 wherein the characteristic is a readable extent of the 

buffer. 
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15. The method of claim 13 wherein the characteristic is a writable extent of the 

buffer. 

5 16. The method of claim 9 wherein the property indicates a location for a buffer 

pointer. 

17. The method of claim 7 wherein the one or more code annotations include a 
qualifier. 

10 

18. The method of claim 17 wherein the qualifier is a precondition qualifier. 

19. The method of claim 17 wherein the qualifier is a postcondition qualifier. 

15 20. The method of claim 17 wherein the qualifier is an except qualifier. 

21 . The method of claim 7 wherein the one or more code annotations include an 
atmotation prefix. 

20 22. The method of claim 21 wherein the annotation prefix comprises a 

dereference prefix at a reference parameter, and wherein the dereference prefix is used 
to specify properties of an object referenced by the reference parameter. 

23. The method of claim 7 wherein the inserting one or more code aimotations 
25 only at one or more annotation targets comprises inserting a first code annotation at a 
reference parameter, and wherein the first code annotation applies to the reference 
parameter itself 
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24. In a computer system, a method of aimotating computer program code 
stored on a computer-readable medium, wherein the computer program code is operable 
to cause a computer to perform according to instructions in the computer program code, 
the method comprising: 

5 inserting an annotation at a value having a value type in the computer program 

code; 

wherein the annotation is a keyword indicating that the value has usability 
properties sufficient to allow a function to rely on the value, wherein the usability 
properties depend on the value type. 

10 

25. The method of claim 24 wherein the value is a formal parameter of the 
function. 

26. The method of claim 24 wherein the value is a return value. 

15 

27. The method of claim 24 wherein the value type is selected fi:om a group 
comprising: scalar, void, pointer, user-defined type, struct. 

28. The method of claim 24 wherein the value is a reference parameter. 

20 

29. The method of claim 24 wherein the value is a pointer, wherein an object 
pointed to by the pointer has one or more readable elements, the one or more readable 
elements of the object each having usability properties sufficient to allow the function 
to rely on the one or more readable elements. 

25 

30. In a computer system, a method of annotating computer program code 
stored on a computer-readable medium, wherein the computer program code is operable 
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to cause a computer to perform according to instructions in the computer program code, 
the method comprising: 

inserting an annotation having an argimient in the computer program code, 
wherein the annotation annotates a value having a first value type, and wherein usability 
5 properties of the value are dependent on the first value type; 

wherein the aimotation indicates that the value has usabiHty properties that 
depend on the properties of a second value type denoted by the argument of the 
annotation. 

10 31. The method of claim 30 wherein the first value type is a legacy value type. 

32. The method of claim 30 wherein the first value type is void *. 

33. The method of claim 30 wherein the first value type is char *. 

15 

34. In a computer system, a method of annotating computer-executable program 
code stored on a computer-readable medium, the method comprising: 

adding an annotation to the computer program code, wherein the annotation 
describes a characteristic of a buffer; and 
20 including a size parameter with the annotation, wherein the size parameter 

describes a portion of the buffer to which the characteristic applies, and wherein the size 
parameter is operable to describe the portion of the buffer using a size specification 
selected from a group of plural different size specifications. 

25 35. The method of claim 34 wherein the group of plural different size 

specifications comprises: byte count, element count, end pointer location, internal 
pointer location, sentinel position. 
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36. The method of claim 34 wherein the amiotation indicates the extent to 
which the buffer is readable. 

37. The method of claim 34 wherein the annotation indicates the extent to 
5 which the buffer is writable. 

38. In a computer system, a method of annotating computer-executable program 
code stored on a computer-readable medium, the method comprising: 

adding an annotation to the computer program code, wherein the annotation 
1 0 comprises an arrangement of lexical components, and wherein the arrangement consists 
of: 

an optional precondition qualifier or postcondition qualifier; followed 
immediately thereafter by 

an optional exception qualifier; followed immediately thereafter by 
15 one or more optional dereference qualifiers; followed immediately 

thereafter by 

a property. 

39. A computer progranraied as a source code annotation system, the computer 
20 comprising: 

a memory storing program code for the source code annotation system; and 
a processor for executing the program code for the source code annotation 

system; 

wherein the program code for the source code annotation system comprises: 
25 program code for instructing a computer to add one or more annotations 

to one or more annotation targets in high-level language source code, wherein 
the one or more annotations each comprise an arrangement of one or more 
lexical components, the arrangement consisting of an optional precondition 
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qualifier or postcondition qualifier, followed immediately thereafter by an 
optional exception qualifier, followed immediately thereafter by one or more 
optional dereference qualifiers, followed immediately thereafter by a property. 

5 40. The computer of claim 39 wherein the high-level language is an object- 

oriented programming language. 



